skills/spotdraft/oncall-investigator-skills/contract-search-stale-assignee-manual-review/Gen Agent Trust Hub
contract-search-stale-assignee-manual-review
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Provides specific query filters and patterns for Groundcover, GCP Cloud Logging, and Elasticsearch to identify race conditions in the contract indexing pipeline.
- [DATA_EXFILTRATION]: Includes BigQuery SQL templates for retrieving contract and manual task data from production-level database mirrors (
spotdraft-prod). This access is intended for cross-referencing DB truth with search index state. - [PROMPT_INJECTION]: Features an indirect prompt injection surface where the agent ingests data from Slack and Jira (ingestion points). There are no boundary markers or sanitization steps documented to prevent malicious instructions in these external sources from influencing the diagnostic process. The agent utilizes these inputs to execute tools like BigQuery SQL and log searchers (capability inventory).
- [EXTERNAL_DOWNLOADS]: References incident context and documentation hosted on Slack, Atlassian (Jira), and Rootly. These resources are consistent with the vendor's internal operations and well-known services.
Audit Metadata